MyPass DokeeAntiCheat

Dokee Code Check

30004D12 /$ 55 PUSH EBP
30004D13 |. 8BEC MOV EBP,ESP
30004D15 |. 8B4D 08 MOV ECX,DWORD PTR SS:[EBP+8]
30004D18 |. 33C0 XOR EAX,EAX
30004D1A |. EB 06 JMP SHORT Dokee.30004D22
30004D1C |> 0FB611 /MOVZX EDX,BYTE PTR DS:[ECX]
30004D1F |. 03C2 |ADD EAX,EDX
30004D21 |. 41 |INC ECX
30004D22 |> 3B4D 0C CMP ECX,DWORD PTR SS:[EBP+C]
30004D25 |.^ 72 F5 \JB SHORT Dokee.30004D1C
30004D27 |. 5D POP EBP
30004D28 \. C3 RETN

3000E49C |. E8 7168FFFF |CALL Dokee.30004D12


3001BE30 $ 8B5424 0C MOV EDX,DWORD PTR SS:[ESP+C]
3001BE34 . 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4]
3001BE38 . 85D2 TEST EDX,EDX
3001BE3A . 74 69 JE SHORT Dokee.3001BEA5
3001BE3C . 33C0 XOR EAX,EAX
3001BE3E . 8A4424 08 MOV AL,BYTE PTR SS:[ESP+8]
3001BE42 . 84C0 TEST AL,AL
3001BE44 . 75 16 JNZ SHORT Dokee.3001BE5C
3001BE46 . 81FA 00010000 CMP EDX,100
3001BE4C . 72 0E JB SHORT Dokee.3001BE5C
3001BE4E . 833D 80023030 00 CMP DWORD PTR DS:[30300280],0
3001BE55 . 74 05 JE SHORT Dokee.3001BE5C
3001BE57 . E9 713A0000 JMP Dokee.3001F8CD
3001BE5C > 57 PUSH EDI
3001BE5D . 8BF9 MOV EDI,ECX
3001BE5F . 83FA 04 CMP EDX,4
3001BE62 . 72 31 JB SHORT Dokee.3001BE95
3001BE64 . F7D9 NEG ECX
3001BE66 . 83E1 03 AND ECX,3
3001BE69 . 74 0C JE SHORT Dokee.3001BE77
3001BE6B . 2BD1 SUB EDX,ECX
3001BE6D > 8807 MOV BYTE PTR DS:[EDI],AL
3001BE6F . 83C7 01 ADD EDI,1
3001BE72 . 83E9 01 SUB ECX,1
3001BE75 .^ 75 F6 JNZ SHORT Dokee.3001BE6D
3001BE77 > 8BC8 MOV ECX,EAX
3001BE79 . C1E0 08 SHL EAX,8
3001BE7C . 03C1 ADD EAX,ECX
3001BE7E . 8BC8 MOV ECX,EAX
3001BE80 . C1E0 10 SHL EAX,10
3001BE83 . 03C1 ADD EAX,ECX
3001BE85 . 8BCA MOV ECX,EDX
3001BE87 . 83E2 03 AND EDX,3
3001BE8A . C1E9 02 SHR ECX,2
3001BE8D . 74 06 JE SHORT Dokee.3001BE95
3001BE8F . F3:AB REP STOS DWORD PTR ES:[EDI]
3001BE91 . 85D2 TEST EDX,EDX
3001BE93 . 74 0A JE SHORT Dokee.3001BE9F
3001BE95 > 8807 MOV BYTE PTR DS:[EDI],AL
3001BE97 . 83C7 01 ADD EDI,1
3001BE9A . 83EA 01 SUB EDX,1
3001BE9D .^ 75 F6 JNZ SHORT Dokee.3001BE95
3001BE9F > 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8]
3001BEA3 . 5F POP EDI
3001BEA4 . C3 RETN
3001BEA5 > 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4]
3001BEA9 . C3 RETN



3000F917 /$ 55 PUSH EBP
3000F918 |. 8BEC MOV EBP,ESP
3000F91A |. 56 PUSH ESI
3000F91B |. 57 PUSH EDI
3000F91C |. 8B7D 08 MOV EDI,DWORD PTR SS:[EBP+8]
3000F91F |. 8A07 MOV AL,BYTE PTR DS:[EDI]
3000F921 |. 33F6 XOR ESI,ESI
3000F923 |. 84C0 TEST AL,AL
3000F925 |. 74 40 JE SHORT Dokee.3000F967
3000F927 |. 53 PUSH EBX
3000F928 |> 0FB6C0 /MOVZX EAX,AL
3000F92B |. 0FB680 389D0330 |MOVZX EAX,BYTE PTR DS:[EAX+30039D38]
3000F932 |. 50 |PUSH EAX
3000F933 |. E8 9C50FFFF |CALL Dokee.300049D4
3000F938 |. 8AD8 |MOV BL,AL
3000F93A |. 0FB6443E 01 |MOVZX EAX,BYTE PTR DS:[ESI+EDI+1]
3000F93F |. 0FB680 389D0330 |MOVZX EAX,BYTE PTR DS:[EAX+30039D38]
3000F946 |. 50 |PUSH EAX
3000F947 |. C0E3 04 |SHL BL,4
3000F94A |. E8 8550FFFF |CALL Dokee.300049D4
3000F94F |. 8B55 0C |MOV EDX,DWORD PTR SS:[EBP+C]
3000F952 |. 59 |POP ECX
3000F953 |. 59 |POP ECX
3000F954 |. 8BCE |MOV ECX,ESI
3000F956 |. 02C3 |ADD AL,BL
3000F958 |. D1E9 |SHR ECX,1
3000F95A |. 46 |INC ESI
3000F95B |. 46 |INC ESI
3000F95C |. 880411 |MOV BYTE PTR DS:[ECX+EDX],AL
3000F95F |. 8A043E |MOV AL,BYTE PTR DS:[ESI+EDI]
3000F962 |. 84C0 |TEST AL,AL
3000F964 |.^ 75 C2 \JNZ SHORT Dokee.3000F928
3000F966 |. 5B POP EBX
3000F967 |> 5F POP EDI
3000F968 |. 5E POP ESI
3000F969 |. 5D POP EBP
3000F96A \. C3 RETN


Error Code in 300120CE but vm.... not retn


so

3000E0A1 75 13 |JNZ SHORT Dokee.3000E0B6

to
jmp xxxxxxx


3000E0A1 75 13 |JNZ SHORT Dokee.3000E0B6
3000E0A3 8B85 60BBFFFF |MOV EAX,DWORD PTR SS:[EBP+FFFFBB60]
3000E0A9 FF34C5 64280B30 |PUSH DWORD PTR DS:[EAX*8+300B2864]
3000E0B0 E8 19400000 |CALL Dokee.300120CE
3000E0B5 59 |POP ECX





but:
jmp xxxxxxx
xor al,al
call 300120CE

normal:
mov al,1
call 300120CE
Therefore, only a modification of a

3000F791 this is check error call


Code has a lot of bother to get one


Dokee Wall Code:


3000B7BF 55 push ebp
3000B7C0 8BEC mov ebp, esp
3000B7C2 51 push ecx
3000B7C3 896D FC mov dword ptr [ebp-4], ebp
3000B7C6 8B45 FC mov eax, dword ptr [ebp-4]
3000B7C9 FF70 04 push dword ptr [eax+4]
3000B7CC E8 4FB60000 call 30016E20
3000B7D1 59 pop ecx
3000B7D2 84C0 test al, al
3000B7D4 75 14 jnz short 3000B7EA
3000B7D6 E8 B63F0000 call 3000F791
3000B7DB 85C0 test eax, eax
3000B7DD 75 0B jnz short 3000B7EA
3000B7DF 68 A5230000 push 23A5
3000B7E4 E8 E5680000 call 300120CE
3000B7E9 59 pop ecx
3000B7EA 837D 08 01 cmp dword ptr [ebp+8], 1
3000B7EE 56 push esi
3000B7EF 8B75 0C mov esi, dword ptr [ebp+C]
3000B7F2 75 3A jnz short 3000B82E
3000B7F4 A1 146A0D30 mov eax, dword ptr [300D6A14]
3000B7F9 FF90 CC000000 call dword ptr [eax+CC]
3000B7FF 83B8 B4030000 0>cmp dword ptr [eax+3B4], 0
3000B806 7F 26 jg short 3000B82E
3000B808 8B00 mov eax, dword ptr [eax]
3000B80A 8B0485 60DF0530 mov eax, dword ptr [eax*4+3005DF60]
3000B811 85C0 test eax, eax
3000B813 74 19 je short 3000B82E
3000B815 8B0E mov ecx, dword ptr [esi]
3000B817 3B048D 60DF0530 cmp eax, dword ptr [ecx*4+3005DF60]
3000B81E 74 0E je short 3000B82E
3000B820 56 push esi
3000B821 E8 80FCFFFF call 3000B4A6
3000B826 0FB6C0 movzx eax, al
3000B829 59 pop ecx
3000B82A 85C0 test eax, eax
3000B82C 76 12 jbe short 3000B840
3000B82E FF75 10 push dword ptr [ebp+10]
3000B831 56 push esi
3000B832 FF75 08 push dword ptr [ebp+8]
3000B835 FF15 60D40530 call dword ptr [3005D460] ; DokeeCS.01943D70
3000B83B 83C4 0C add esp, 0C
3000B83E EB 02 jmp short 3000B842
3000B840 33C0 xor eax, eax
3000B842 5E pop esi
3000B843 C9 leave
3000B844 C3 retn